Which versions of OpenClaw are affected by CVE-2026-43530?

OpenClaw npm package versions 2026.2.23 through 2026.4.11 contain an authorization bypass vulnerability that allows authenticated users to execute arbitrary shell commands by circumventing execution…. A patch is available.

How to fix or mitigate CVE-2026-43530?

Within 24 hours: identify all internal and third-party applications using OpenClaw npm package versions 2026.2.23 through 2026.4.11 via dependency scanning. Within 7 days: upgrade all affected instances to version 2026.4.12 or later and conduct functional testing. Within 30 days: audit execution logs for any suspicious command invocations via busybox or toybox binaries in the 90-day window prior to patching.

OpenClaw CVE-2026-43530

Q: What is the CVSS score of CVE-2026-43530?

CVE-2026-43530 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-27271 HIGH

Incorrect Authorization (CWE-863)

2026-05-05 VulnCheck

GHSA-2cq5-mf3v-mx44

Authentication Bypass Openclaw

8.7

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

May 05, 2026 - 12:50 vuln.today

v2 (cvss_changed)

Re-analysis Queued

May 05, 2026 - 12:37 vuln.today

cvss_changed

CVSS changed

May 05, 2026 - 12:37 NVD

8.8 (HIGH) 8.7 (HIGH)

Source Code Evidence Fetched

May 05, 2026 - 12:18 vuln.today

Analysis Generated

May 05, 2026 - 12:18 vuln.today

DescriptionCVE.org

OpenClaw versions 2026.2.23 before 2026.4.12 contain a weakened exec approval binding vulnerability in busybox and toybox applet execution that allows attackers to obscure which applet would actually run. Attackers can exploit opaque multi-call binaries to bypass exec approval mechanisms and weaken risk classification of unsafe applet invocations.

AnalysisAI

Authenticated remote attackers can bypass exec approval mechanisms in OpenClaw npm package versions 2026.2.23 through 2026.4.11 by invoking busybox or toybox multi-call binaries. The vulnerability (CWE-863: Incorrect Authorization) allows attackers to obscure which applet will execute, weakening risk classification for unsafe operations like shell command injection via 'busybox awk BEGIN{system("id")}' or 'toybox ash -c'. CVSS 8.7 (CVSS:4.0/AV:N/AC:L/PR:L) indicates network-accessible exploitation by low-privileged authenticated users. Vendor-released patch available in version 2026.4.12. EPSS and KEV data not provided; no public exploit identified at time of analysis beyond vendor-disclosed commit.

Technical ContextAI

OpenClaw is an npm package (cpe:2.3:a:openclaw:openclaw) that implements exec approval binding to classify and control subprocess invocations. The vulnerability stems from treating busybox and toybox - multi-call binaries where a single executable provides multiple applets via argv[0] or first argument - as safe binaries without recognizing their opaque runtime behavior. Multi-call binaries like 'busybox sh -c payload' or 'toybox awk BEGIN{system()}' can execute arbitrary commands through applets that weren't explicitly approved. CWE-863 (Incorrect Authorization) applies because the approval mechanism failed to enforce intended access restrictions on these interpreter-like wrappers. The fix refactors unwrapArgvForMutableOperand() to track opaqueMultiplexerSeen, treats busybox/toybox as OPAQUE_MUTABLE_SCRIPT_RUNNERS, and fails closed by returning null from resolveMutableFileOperandIndex() when these binaries are detected, preventing unsafe applet invocations from being approved.

RemediationAI

Upgrade to OpenClaw version 2026.4.12 or later (npm install openclaw@2026.4.14 or newer). The fix in commit 666f48d9b882a8a1415ca53f9567c72499d850c9 (PR #65713) treats busybox and toybox as opaque mutable script runners, failing closed when these binaries are invoked rather than attempting to bind individual applets. Advisory at https://github.com/openclaw/openclaw/security/advisories/GHSA-2cq5-mf3v-mx44 and patch at https://github.com/openclaw/openclaw/commit/666f48d9b882a8a1415ca53f9567c72499d850c9. If immediate upgrade is not feasible, remove busybox and toybox from tools.exec.safeBins configuration to block invocation (side effect: legitimate use of these utilities will be denied), or migrate to explicit allowlist entries specifying exact applet paths (/bin/busybox-awk) rather than the multiplexer binary, though this requires manual mapping of all needed applets and may be operationally complex.